randombit

It's not really a significant factor here - the Botan build system allows you to select what features you want to include. For example if you wanted a binary that just supports AES, GCM, SHA-256, and ECDSA, with nothing else, that's easily done.

It's not just only limited to commercial spyware. It's limited to restricting "commercial spyware that poses significant counterintelligence or security risks to the United States Government", ie they should only use high quality commercial spyware.

18992.1(b) excludes UBI for anyone "receiving benefits under the Medi-Cal program, the County Medical Services Program, the CalFresh program, the CalWORKs program, or Unemployment Insurance" so if you are currently receiving any form of welfare, f you, otherwise here's your free money? Seems like a really strange approach for something that is trying to improve economic security. Does anyone know what the reasoning here is?

Isn't that what I said?

Edit: fortunately it looks like certbot plans to support using the old intermediate https://github.com/certbot/certbot/issues/6971 so this should not prove necessary.

Tried the test site on a Nexus 7 running Android 6.0.1, Firefox was ok (seems it ships with its own list of roots), but latest Chrome rejected it.

My wife runs a blog which generates substantial income and uses certs from Let's Encrypt. It's a non-tech blog with primarily US readership. Checking stats for this month, 7% of all visitors were using Android 4/5/6 (20% of all Android users). The percentage of users on old Android running Firefox was basically nil. Losing all these users would be very costly.

Hopefully certbot will be modified so it is possible to pick the current intermediate during automatic renewal. If I have to do a manual operation to switch intermediates each time the cert renews (currently done by cronjob) then it is probably safer (operationally speaking) to just buy a cert.

I don't really understand why Let's Encrypt is making this change now. Sure, the current root is expiring "soon", but not until September 2021. Switching roots could be safely pushed off to early 2021 at which point hopefully most of these older Androids would be cycled out.

Solar panels don't depreciate in the same way as most silicon. 20 years later, panels will still be producing power just fine, albeit with some degradation.

Source: my house has 23 year old solar panels, my garage has 10 year old panels, they all still produce plenty of electricity.

There are plenty of reasons to avoid dealing with these companies, but this isn't one of them.

I've been flown to interviews at least a half dozen times over the years, mix of startups and big companies, every time travel (flight+hotel+meals) was covered as a matter of course. I would absolutely turn down an interview where they weren't paying for travel, it suggests they are not serious about the process.

https://en.m.wikipedia.org/wiki/Operation_Aurora

https://www.nytimes.com/2010/01/13/world/asia/13beijing.html

Alas, I just started working on a Rust wrapper for Botan https://crates.io/crates/botan

The existing Botan C API is in fact sufficient for OpenPGP already, https://github.com/riboseinc/rnp is in C++ now but was originally C and uses Botan's C API.

But Nettle is IMO quite solid and the developer is very skilled, so full steam ahead.

Is there any relation between Sequoia and the BoringPGP spec?

Been working remote in Vermont for a decade now. Love it here and now that we have kids I'm not even considering moving anywhere. Nature, plenty of space, cheap (at least by major city standards), good food and beer scene, people are friendly, good schools if you pick the right town.

My only complaints would be slow Internet (though fiber is more common these days) and the ticks. And it gets cold sometimes, some people don't like that.

The source code of procmail is terrifying

It has WLE200NX a/b/g/n PCIe with antennas (all from PC Engines), plus an Alfa g/n 2000mW adaptor at the end of a long USB cable, positioned for better reception in another building ~150 feet away (n devices are mostly fine without it but especially old b/g devices had a hard time). Before that, wifi had been managed by an RT-N66U, and a repeater had been required to reach the other building. For my setup the APU2 actually replaced 3 devices which had previously been required: Erlite-3 router, RT-N66U, plus repeater. And more to the point, replaced 3 key network infrastructure devices, all running different commercial/closed software, with a single device running a security focused Linux distro and open source boot firmware.

As to load, it manages just a household's worth of machines, maybe ~10 wireless clients and ~10 more devices on the LAN side. The load on the machine is effectively zero. I would personally be confident building such a setup for even 100 clients. The 2 PCI + 2 USB3 offers many expansion options and the SoC itself is tens of times faster than most home routers.

This is not quite what you ask for and a little more expensive that some options, but I use a PC Engines APU2 running Alpine as my router+wifi access. Great little machine that is much more functional than typical home router hardware, and it boots using coreboot. A good option if you like setting up everything by hand.

More about APU2 at http://www.pcengines.ch/apu2b4.htm

miTLS is a stack written in annotated F# and definitely a promising step in that direction https://github.com/mitls Unfortunately it doesn't offer a C-compatible ABI as far as I know, so not usable by native code applications.

Vermonters want to do whatever the hell they want on their own land.

Within the constraints of zoning, which are very strict both at the state level (Act 250 would certainly come into play for a development this large) and often at the town level also (don't know about Sharon). Vermont's zoning is partially oriented towards keeping as much green space and working farmland available as possible... maybe there are places where you can just buy up hundreds of acres farmland and turn it into strip malls and high density housing but Vermont is thankfully not one of them.

As another example of what you cannot do with your land in Vermont - you cannot put up a billboard on it. There was a case recently where a mural painted on a barn wall within sight of the highway was declared a roadside ad and had to be removed. You don't realize how just ugly and tacky billboards are until you live in a place without them for a few years...

Location: Montpelier, VT

Remote: Yes (been remote full time for 5+ years)

Willing to relocate: No

Technologies (key): C++, Python, Unix systems programming, security review, cryptography

Technologies (hobbyist or occasional): Django, OCaml, Common Lisp, Java, C#

Email: jack.lloyd@gmail.com

CV: http://randombit.net/resume.pdf

GH: https://github.com/randombit

Currently engaged in building, debugging, and production support of low-latency trading systems. Prior to that I was a security consultant reviewing software systems and cryptographic implementations, as well as network exploitation. Security has remained my ongoing interest and passion, and I'm looking to apply what I've learned building systems to an unique security product, or alternately return to full time security consulting.

SEEKING WORK - Remote (or in central Vermont)

My background is somewhat twofold, in security/crypto review and building high performance distributed systems for trading. I'd be especially interested in projects involving reviewing code and protocols for security flaws, distributed systems development, low latency network code, and the design and coding of security critical components.

The majority of my production code has been in C++ and Python, but I'd be happy diving into a project in C, Java, Scala, Go, or Rust. I mostly use and develop for Linux.

Some past open source work is at https://github.com/randombit

Drop me a line at lloyd@randombit.net and we can talk about what you are trying to do and if I'm the right fit for your problem.

It's no longer available via the Mozilla bug report, but a copy is included in the Caja sources:

http://code.google.com/p/google-caja/source/browse/trunk/thi...

He is referring to password hashing where brute forcing is an issue. For a cryptographic hash function, the goal is to be as fast as possible while retaining security. There is currently an intensive competition between the SHA-3 teams to produce the fastest implementations. Check out http://bench.cr.yp.to/results-sha3.html for more performance data on a range of machines.

It's not always the case that a hash that is faster in software is easier or cheaper to implement in hardware. For instance Skein is very fast on x86-64 but apparently is less competitive in low power hardware implementations.

> Let's face it, being an entrepreneur is not for everyone. > It's a lot of work and responsibility; something the > majority of 20-somethings can't handle.

It's easy to forget that software is probably the least capital intensive industry that's open to a lone entrepreneur. Think about someone wanting to start, say, a basic small bakery operation. My wife did this, and the capital costs necessary to just get started and make that first batch of sales - ingredients, packaging materials, special implements like decorating tips - could easily be enough to deter someone who has little capital to work with. (And we already had a good kitchen with the majority of tools one would need). It's one thing to risk a month of time when you're otherwise idle, it's another to risk next month's rent payment as well.

I think you missed the link? http://www.phoronix.com/scan.php?page=news_item&px=MTA1M...

They also claim that programming requires "The ability to add, subtract, multiply, or divide quickly and correctly."

I'm skeptical.

Nothing about latency in there or on their website as far as I could find. Having used satellite for a while before switching to a microwave relay system, I can say it's not the bandwidth that's the issue, it's the latency. 800 ms ping times make for an exceptionally poor browsing experience, and SSH and rdesktop are nearly impossible. It's possible their approach is using LEO sats instead of geosync orbits, but in that case they'd need a lot more birds to get consistent coverage, and doesn't match up with their only supporting the US coasts currently.

Exactly. And nobody thinks that for loops are "magic".

> when the only "magic" was basic virtual functions

What's "magic" about structs of function pointers? This is a classic idiom in C, just given a specialized syntax in C++.

Olshansky admits that "All of these presidents benefited from the trifecta of exceptional wealth, almost all were highly educated and all of them had access to medical care," and yet he decided to compare them to a 'cohort' consisting of the general population.

_For example, look at crypto algorithms like DES that, ten years ago, people thought would take thousands of years to crack given Moore's law growing computational resources._

Whitfield Diffie proposed triple DES in 1975 (even before the FIPS was published), because it was obvious even then that a 56 bit key would not be sufficient for long term security against attackers with serious financial/technological resources. EFF's Deep Crack broke a DES key in less than a day 13 years ago. The AES selection process started in 1998, and a winner finalized in 2001. I'm not sure where you're getting your history from here.

They show up as a hovertext in FF

The actual directive seems to be 14436/10 which is available here - http://register.consilium.europa.eu/pdf/en/10/st14/st14436.e...

The relevant portion is Article 7

""" Member States shall take the necessary measure to ensure that the production, sale, procurement for use, import, possession, distribution or otherwise making available of the following is punishable as a criminal offence when committed intentionally and without right for the purpose of committing any of the offences referred to in Articles 3 to 6:

(a) device, including a computer program, designed or adapted primarily for the purpose of committing any of the offences referred to in Articles 3 to 6;

(b) a computer password, access code, or similar data by which the whole or any part of an information system is capable of being accessed. """

Which seems to be saying that, say, nmap isn't illegal, unless you download it with the intent to run it against a machine you're not supposed to, in which case you've broken the law (even if you never actually use it). Kind of like laws against 'burglary tools' in some parts of the US, the crime seems to be based on context/intent.

(Obvious disclaimer about how I'm not a lawyer, European, or a unicorn.)

'they might feel they have to lie to keep their job'

Because that's not a warning sign at all! boggles

Most people of course answer this question in the same way an interviewee does when asked 'Why did you leave your last position?'. Nobody will ever answer 'that jerk across the hall, I can't STAND that guy'. They will answer something that gives some insight into the company culture. I don't think it's a coincidence, for instance, that easily half the people at Google I've put this question to have answered something along the lines of 'management chaos/confusion', 'the tendency for two internal projects to be competing with each other without even knowing about it', etc.

I should have added the followup to my first question is what they like most. Both can be very informative, of course, and following up with that helps put them at ease for the rest of the interview, since many interviewers aren't expecting a question like this one. But it's really worth it. An interview isn't just to answer 'will you hire me', it also must answer 'will I enjoy working here'. The second is much more important to me.